Security researchers have discovered a malware campaign, dubbed Midnight Mimosa, that infects low-cost Android smartphones before they are even powered on, raising serious concerns about device security.
Purchasing a budget smartphone may seem like a wise choice, especially when these devices promise large screens, decent cameras, and access to popular Android applications. However, a recent investigation has revealed that some of these affordable phones may come with a hidden threat already embedded in their firmware.
Researchers at Bitdefender have identified a malware campaign known as Midnight Mimosa, which infects certain low-cost Android devices before they are activated by their owners. This malicious software resides within the phone’s firmware, granting attackers significant access that typical applications do not possess. Alarmingly, related malicious applications have also been found on Google Play, and this issue has reached the United States.
Most smartphone security advice emphasizes the importance of being cautious about app downloads. While this is sound advice when dealing with potentially harmful applications, Midnight Mimosa alters the landscape, as the infection can be present upon purchase. According to Bitdefender’s findings, the malware has been detected on various low-cost Android devices that utilize MediaTek chipsets. Researchers discovered malicious applications embedded within the system software, allowing them to operate with elevated privileges.
These elevated privileges enable the malware to install additional applications without user consent, remove existing apps, and grant sensitive access to other software. It can also download and execute new code from remote servers. Bitdefender identified several versions of the malware disguised under seemingly innocuous Android package names, such as com.android.system.lite and com.android.sys.prot. To the average phone owner, these names may appear as legitimate technical components, making the malware difficult to detect.
Because the malware resides in the system partition, a standard uninstall process will not eliminate the underlying infection. Bitdefender has observed Midnight Mimosa on thousands of unique devices across over 150 countries over the past two years. The highest concentrations of infected devices were found in Mexico, France, and Italy, followed by the United States, Germany, Brazil, and Spain. Some of the affected devices include models associated with Doogee’s S200 X and Cubot’s KINGKONG X, though not every phone sold under these names is necessarily compromised.
Further complicating matters, some devices have been found to masquerade as high-end smartphones. Certain models reported names resembling premium Samsung Galaxy devices or Apple’s iPhone, while actually containing low-cost Android hardware with modified software. Some counterfeit devices even displayed legitimate Samsung model identifiers, making it challenging to verify authenticity based solely on model names.
Bitdefender’s investigation also uncovered firmware signed with certificates linked to Shenzhen Zediel, a Chinese device manufacturer. However, the researchers clarified that this does not imply that the company created the malware or was aware of its presence. The exact point at which the malicious code infiltrated the manufacturing and distribution processes remains unclear.
Rather than immediately stealing passwords or displaying overt warnings, Midnight Mimosa appears to be primarily designed to generate revenue for its operators while remaining inconspicuous. One method of monetization involves advertising fraud, where the malware silently installs applications that mimic everyday utilities, such as weather tools or app lockers. These applications can display legitimate advertisements in hidden windows or generate clicks without user interaction, leading advertisers to pay for non-genuine activity.
Bitdefender identified at least 32 unique disguised applications involved in this operation. Additionally, the malware has the capability to convert infected phones into residential proxy servers, allowing cybercriminals to route internet traffic through the victim’s connection. This can obscure the true origin of online activity, potentially facilitating larger botnet operations or distributed denial-of-service attacks.
One particularly concerning aspect of Midnight Mimosa is its ability to evade security checks. Before installing certain malicious applications, the malware temporarily disables the Google Play Store app, which helps it avoid detection by Google Play Protect. Once the installation is complete, the malware re-enables the Store, reducing the likelihood that the phone owner will notice anything amiss.
Some versions of the malware also manipulate Android’s installer records, making it appear as though applications originated from Google Play, even when they were installed directly by the malware. This can mislead users during a quick review of app origins.
Researchers discovered several applications associated with the malware, including Wavrge, App Icon DIY, and Daily Weather, which offered various functionalities but also generated unwanted advertising activity. While these apps were found on Google Play, checks revealed that none were currently available for download, leaving it unclear whether Google removed them or if their developers withdrew them.
If you suspect your device may be infected, it is crucial to check the installed apps against Bitdefender’s report and verify their package identifiers before uninstalling. Even if an app disappears from Google Play, it may still be installed on your device.
Concerns about the integrity of firmware updates have also emerged, with some users reporting that official updates introduced infections. In these cases, reverting to an older firmware version temporarily resolved the issue, but reinstalling the newer update brought the infection back. This creates a frustrating situation for owners, as software updates are typically encouraged for enhanced security.
To protect yourself, it is advisable to be cautious when purchasing unusually cheap smartphones that are marketed as premium models. Always choose established retailers and authorized sellers, and verify the device’s specifications on the manufacturer’s official website. If a deal seems too good to be true, it likely deserves further scrutiny.
Before trusting an unfamiliar Android phone, check whether it is recognized as a certified device by Google. Play Protect certification indicates that a device meets Google’s compatibility requirements, but it does not guarantee that its firmware is free from malware.
For those who already own a budget Android phone, it is essential to enable Google Play Protect and regularly check for harmful apps. Additionally, consider using strong antivirus software to add another layer of protection. This software can monitor suspicious behavior and detect threats that may go unnoticed by traditional scans.
If you believe your phone has been compromised, use a separate trusted device to change important passwords and review recent account activity. Enabling multifactor authentication where available is also a prudent measure.
The findings from this investigation highlight a significant issue within the budget smartphone market. When malware is embedded in the firmware, consumers have little control over their devices. Manufacturers and marketplaces must take greater responsibility for ensuring the software integrity of the products they sell. A low price should never come at the cost of user privacy and security.
For more information, refer to Bitdefender’s report on this issue.